Black Hat Courses

We Are About to Land - How CloudDragon Turns a Nightmare Into Reality

Explore CloudDragon's advanced cyber tactics, including supply chain and cross-platform attacks. Gain insights into APT group operations and their evolving techniques in this cybersecurity analysis.

• YouTube
• 35 minutes
• Self-Paced
• Conference Talk

Pre-built JOP Chains with the JOP ROCKET - Bypassing DEP without ROP

Explore Jump-oriented Programming (JOP) as an alternative to ROP for code-reuse attacks. Learn about the JOP ROCKET tool for creating pre-built JOP chains to bypass DEP without ROP.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

Vibe Check - Why Students May Shy Away From Cyber in a Surveillance State

Explores impact of surveillance and strict laws on cyber talent in Asia Pacific, discussing challenges for ethical hacking and threat research in a censorship-heavy environment.

• YouTube
• 37 minutes
• Self-Paced
• Conference Talk

A Mirage of Safety - Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection Apps

Uncovers vulnerabilities in popular Android privacy protection apps, revealing security flaws and exploit techniques. Offers insights on improving mobile data security and privacy safeguards.

• YouTube
• 22 minutes
• Self-Paced
• Conference Talk

Alarm.DISARM - Remotely Exploiting & Disarming Popular Physical Security System from Public Internet

Explore remote code execution vulnerabilities in physical security systems, learning to exploit and disarm alarms through reverse engineering and network protocol analysis.

• YouTube
• 36 minutes
• Self-Paced
• Conference Talk

New Attack Surface in Safari - Using Just One Web Audio Vulnerability to Rule Safari

Explores a novel attack surface in Safari, focusing on vulnerabilities in system libraries like audio. Demonstrates how a single Web Audio vulnerability can be exploited to compromise Safari's security.

• YouTube
• 27 minutes
• Self-Paced
• Conference Talk

The Tangled Webview - Javascriptinterface Once More

Unveils new Android WebView vulnerabilities related to JavascriptInterface, bypassing all verifications. Presents a novel attack model and discusses security implications for mobile app developers.

• YouTube
• 22 minutes
• Self-Paced
• Conference Talk

A Walk Through Historical Correlations Between Vulnerabilities and Stock Prices

Explore the impact of security vulnerabilities and data breaches on stock prices across industries, analyzing recovery patterns and sector-specific effects through historical data analysis.

• YouTube
• 29 minutes
• Self-Paced
• Conference Talk

Analyzing and Fuzzing for Qualcomm Hexagon Processor

Explore techniques for analyzing and fuzzing Qualcomm Hexagon processors, overcoming challenges in firmware analysis, emulation, and hardware-dependent targets for enhanced security research.

• YouTube
• 38 minutes
• Self-Paced
• Conference Talk

In-Field Emulation and Fuzzing of PLCs to Uncover the Next Zero-Day Threat in Industrial Control Systems

Explore innovative techniques for uncovering vulnerabilities in Industrial Control Systems through in-field emulation and fuzzing of PLCs, focusing on proactive security measures beyond network-level exploits.

• YouTube
• 39 minutes
• Self-Paced
• Conference Talk

Manufacturing Hardware Implants from Idea to Mass Production - A Hacker's Journey

Explore the journey of creating and mass-producing hacking devices, from initial concept to final product. Learn about R&D, quality assurance, and manufacturing challenges in hardware development.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

Circumventing the Guardians - How the Security Features in State-of-the-Art TLS Inspection Solutions Can Be Exploited for Covert Data Exfiltration

Unveiling a stealthy data exfiltration method that bypasses TLS inspection security solutions. Learn about SNIcat and how it circumvents perimeter defenses, with insights on mitigation and detection strategies.

• YouTube
• 26 minutes
• Self-Paced
• Conference Talk

BinTyper - Type Confusion Detection for C++ Binaries

Explore a novel approach to detect type confusion vulnerabilities in C++ binaries, enhancing software security against malicious code execution attacks.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

Jack-in-the-Cache - A New Code Injection Technique through Modifying X86-to-ARM Translation Cache

Explores a novel code injection technique for Windows 10 on ARM, exploiting vulnerabilities in x86-to-ARM translation cache to compromise system security on ARM-based laptops.

• YouTube
• 25 minutes
• Self-Paced
• Conference Talk

FPs Are Cheap - Show Me the CVEs

Evaluating SAST tools: Learn how to assess their effectiveness in finding real vulnerabilities using synthetic test suites and practical examples of CVEs.

• YouTube
• 24 minutes
• Self-Paced
• Conference Talk